Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
Plex patched multiple undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0, urging all users to update immediately.
Plex released fixes in Plex Media Server 1.43.3 and Plex Desktop 1.115.0 for multiple undisclosed security flaws, with CVE identifiers requested and details not yet published. Censys data shows more than 360,000 devices expose the Plex Media Server web interface. Past Plex flaws saw real exploitation, including CVE-2020-5741 (CVSS 7.2), used to implant a keylogger on a LastPass employee's home computer during the 2022 breach, and CVE-2025-34158 (CVSS 8.5), an authentication bug patched in August 2025.
- Fixes shipped in Plex Media Server 1.43.3 and Desktop 1.115.0
- CVE identifiers requested; flaw details still undisclosed
- Over 360,000 Plex Media Server web interfaces exposed per Censys
- Plex bug CVE-2020-5741 was used in the 2022 LastPass breach
- NAS users may need to install updated packages manually
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-5741 | Authenticated Deserialization RCE in Plex Media Server on Windows | 7.2 | 73% | KEVPoC ×2 | KEV |
| CVE-2025-34158 | Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the… | 8.5 | <1% |
From the original article
2 min read at thehackernews.com
Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws. The fixes are available in Plex Media Server 1. 43.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.